Method and apparatus for enabling purchase of or information requests for objects in digital content

ABSTRACT

A client computing system renders digital content (such as, for example, a movie or TV program) for a user. Based on the user&#39;s interest, the user may select an object image in a video frame of a sequence of video frames of the digital content being rendered. The user input data indicating the object image selection may be sent to a service provider server coupled to the client computing system over a network via a secure communications channel. The server obtains information about an object corresponding to the user-selected object image. The server sends the object information to the client computing system for display to the user. The object may be an object in the physical world, such as a consumer good. The object information may include information enabling the user to purchase the object.

FIELD

The present disclosure generally relates to the field of computingsystem architectures for securely processing digital content. Moreparticularly, an embodiment of the invention relates to enabling thepurchase of, or information requests for, objects in digital contentbeing processed by a computing system.

BACKGROUND

On open computing platforms, such as a personal computer (PC) system forexample, when playing premium content (such as from a DVD, Blu-Ray,etc.), the digital rights management (DRM) processing and key managementare typically performed in software by a media player applicationprogram. These schemes are not well protected and there have beeninstances of hacking, resulting in pirated content and loss of revenueto content owners. When content is played, even though the mediadecompression (such as H.264, MPEG-2, etc.) is done in hardware, thecontent is in the clear in system memory and can be stolen withsoftware-based and/or hardware-based attacks. Due to these notedsecurity weaknesses, only lower fidelity (such as standard definition(SD)) content or less valuable high definition (HD) content is typicallydistributed to open computing platforms. Improvements to the securehandling of digital content by open computing platforms (such as a PC,for example) are desired.

BRIEF DESCRIPTION OF THE DRAWINGS

The detailed description is provided with reference to the accompanyingfigures. The use of the same reference numbers in different figuresindicates similar or identical items.

FIG. 1 is a diagram of a secure content processing pipeline according toan embodiment of the present invention.

FIG. 2 is a diagram of a service provider server and security servicesinfrastructure according to an embodiment of the present invention.

FIG. 3 is a diagram of a client computing system according to anembodiment of the present invention.

FIG. 4 is a flow diagram of secure content processing according to anembodiment of the present invention.

FIG. 5 is a diagram of a secure content processing system according toan embodiment of the present invention.

FIG. 6 is a flow diagram of object information processing according toan embodiment of the present invention.

FIG. 7 is a diagram of object information processing components on aservice provider server according to an embodiment of the presentinvention.

DETAILED DESCRIPTION

Embodiments of the present invention comprise a system architecture thatprovides a hardware-based root of trust (HW ROT) solution for supportingdistribution and playback of premium digital content. In an embodiment,HW ROT for digital content and services is a solution where the basis oftrust for security purposes is rooted in hardware and firmwaremechanisms in a client computing system, rather than in software. Fromthis root of trust, the client computing system constructs an entiremedia processing pipeline that is protected for content authorizationand playback. In embodiments of the present invention, the security ofthe client computing system for content processing is not dependent onthe operating system (OS), basic input/output system (BIOS), mediaplayer application, or other host software. In order to compromise thesystem, one will need to compromise the hardware and/or firmwaremechanisms, as opposed to attacking the software running on top of theOS.

Embodiments of the present invention provide services for purchase of,or information requests for, objects shown in displayed images indigital content being processed by the client computing system.

In the following description, numerous specific details are set forth inorder to provide a thorough understanding of various embodiments.However, various embodiments of the invention may be practiced withoutthe specific details. In other instances, well-known methods,procedures, components, and circuits have not been described in detailso as not to obscure the particular embodiments of the invention.Further, various aspects of embodiments of the invention may beperformed using various means, such as integrated semiconductor circuits(“hardware”), computer-readable instructions organized into one or moreprograms stored on a computer readable storage medium (“software”), orsome combination of hardware and software. For the purposes of thisdisclosure reference to “logic” shall mean hardware, software (includingfor example micro-code that controls the operations of a processor),firmware, or some combination thereof.

Embodiments of the present invention protect content protectionprocessing, key management processing, and content playback by usingfirmware and hardware in the CPU, chipset and integrated graphics/mediaengine of a client computing system 101 to perform these functions.Embodiments of the present invention provide end-to-end protection ofthe content as the content is processed by components within a computingsystem. FIG. 1 is a diagram of a secure content processing pipeline 100according to an embodiment of the present invention. Content 102 may beaccessible by a service provider (SP) server 104. Content 102 may be anydigital information, such as audio, video, or audio/video data, images,text, books, magazines, games, or application programs. Service providerserver 104 may include one or more servers for providing the content toa client computing system over any telecommunications channel (such asthe Internet, cellular networks, wired or wireless networks, etc.).Content may be protected by any known content protection technology 106(e.g., digital rights management (DRM) technology, cryptographictechniques, etc.) while stored in the SP server and during transfer tothe client computing system 101. In one embodiment, the content may beprotected by the Enhanced Privacy ID (EPID) signature verificationprotocol as discussed herein. In one embodiment, video data may beencrypted using the Advanced Encryption Standard (AES) cryptographicprocessing with CTR mode. The client computing system 101 may be a PC,laptop, netbook, tablet computer, handheld computer, smart phone,personal digital assistant (PDA), set top box, consumer electronicsequipment, or any other computing device capable of receiving, storingand rendering content.

Within the client computing system, content protection processing 110may be performed by a Security Processor 108. In one embodiment, thesecurity processor may be within a chipset of the client computingsystem. In an embodiment, the chipset comprises a platform control hub(PCH). In another embodiment, the Security Processor may be within theCPU of the client computing system. In another embodiment having asystem-on-chip (SOC) configuration, the Security Processor may beintegral with other system components on a single chip. In oneembodiment, the security processor comprises a Manageability Engine(ME). In other embodiments, other types of security processors may beused. The Security Processor is a subsystem implemented in hardware andfirmware that interacts with other components of the client computingsystem. The Security Processor operates by loading firmware code from aprotected flash memory region and executing the firmware code inprotected memory. Since the content protection processing is performedin hardware and firmware within the Security Processor, protection ofthe content may be improved over software-based systems.

Cryptographic key information may be sent from the security processorover a protected chip to chip interconnect 112 to a component containinga central processing unit (CPU) and an integrated graphics (GFX)/mediaengine. In an embodiment, the protected chip to chip interconnect 112comprises a secure Direct Media Interface (DMI) communications link tothe CPU/GFX component. DMI comprises a chip-to-chip interconnect withtwo unidirectional lanes of concurrent data traffic, and isochronoustransfer with improved quality of service. Data transferred over the DMIlink may be protected by known cryptographic processing techniques. Inan embodiment, the chip-to-chip secure link may be used for passingencrypted title keys over the DMI. Security is based on a shared secretbetween the PCH and the CPU. This shared secret may be established oneach power cycle and can vary between families of products, generationsand random groupings as needed to ensure protection and integrity of theshared secret. The DMI mechanism is independent of the OS, the BIOS, andsoftware running on the CPU. The DMI mechanism may be used to create atrust relationship between the security processor (in the PCH) and theCPU.

The GFX engine 114 may include content protection processing to decryptthe content. The GFX engine also includes decoder logic 121 toprocess/decode the decrypted audio/video content and pass theaudio/video content as media blocks to a graphics processing unit (GPU)within the GFX engine 114. The GPU includes security techniques,including using encoder logic 123, to protect the media blocks duringprocessing in memory. GFX engine 114 also includes composition logic 125to compose the image data to be shown on display 118. As the content isbeing handled within and between the security processor in the PCH andthe GFX engine in the CPU/GFX component, the content may be protected bya hardware protected data path 116. In an embodiment, the hardwareprotected data path comprises a Protected Audio Video Path (PAVP) tomaintain the security of the content. PAVP also supports an encryptedconnection state between system components. By using the PAVP, thesystem may further protect the content during transfer between systemcomponents and within memory.

The interface between the GFX engine, the PCH, and the display 118 maybe implemented by protected wired/wireless display links 120. In oneembodiment, display data sent from the GFX engine via a memory throughthe PCH to the display may be protected by a High-Bandwidth DigitalContent Protection (HDCP) content protection scheme. The HDCPspecification provides a robust, cost-effective and transparent methodfor transmitting and receiving digital entertainment content tocompliant digital displays. In an embodiment, the wired link may beimplemented according to the HDCP Specification, Revision 2.0, availablefrom Digital Content Protection, LLC, or subsequent revisions. HDCP maybe employed to deter copying of the display data as the data travelsover a DisplayPort, Digital Visual Interface (DVI), High-DefinitionMultimedia Interface (HDMI), Gigabit Video Interface (GVIF), or aUnified Display Interface (UDI) connection. The HDCP revision 2.0specification addresses emerging usage models that let end usersconveniently connect displays, devices and home theater systems viastandard protocols and interfaces like TCP/IP, USB, Wi-Fi andWirelessHD. The HDCP revision 2.0 specification uses standards-based RSApublic key and Advanced Encryption Standard (AES) 128-bit encryption forrobust content protection. In an HDCP system, two or more HDCP devicesare interconnected through an HDCP-protected interface. The audiovisualcontent protected by HDCP flows from the Upstream Content ControlFunction into the HDCP system at the most upstream HDCP Transmitter.From there, the HDCP content, encrypted by the HDCP system, flowsthrough a tree-shaped topology of HDCP receivers over HDCP-protectedinterfaces.

The HDCP content protection mechanism includes three elements: 1)Authentication of HDCP receivers to their immediate upstream connection(to an HDCP transmitter). The authentication protocol is the mechanismthrough which the HDCP transmitter verifies that a given HDCP Receiveris licensed to receive HDCP. 2) Revocation of HDCP receivers that aredetermined by the DCP to be invalid. 3) HDCP encryption of audiovisualcontent over the HDCP-protected interfaces between HDCP transmitters andtheir downstream HDCP receivers. HDCP receivers may render the HDCPcontent in audio and visual form for human consumption. HDCP receiversmay be HDCP repeaters that serve as downstream HDCP transmittersemitting the HDCP content further downstream to one or more additionalHDCP receivers. In one embodiment, display data sent to the display 118may be sent over a protected wireless display (WiDi) link 127 using802.11 n wireless local area network (WLAN) technology.

As can be seen from FIG. 1, in embodiments of the present invention,from the time the content is received from the service provider server104 until the content is displayed on the display 118, no cryptographickey or content is available in unencrypted form to any software orunauthorized hardware running on the computing system. Further, memoryprotection for video data is offered over the whole chain across thedecrypt, decode/encode, compose and display pipelines. This capabilityis offered at the full memory bandwidth without compromising overallsystem performance.

FIG. 2 is a diagram of a service provider server 104 and a securityservices component 202 according to an embodiment of the presentinvention. In an embodiment, security services component 202 maycomprise one or more servers and/or components. In an embodiment, thesecurity services component may be operated by the manufacturer of oneor more components of the client computing system. The security servicescomponent provides capabilities for controlling client computing systemsin the field. The security services component comprises a manufacturingcomponent and a deployment component. The manufacturing componentincludes a certificate issuance component 218, a key generation (KeyGen) component 220, and a fuse programming (Fuse Prog) component 222.Certificate issuance 218 generates and issues public key certificates toeach of the client computing platforms. Key Gen 220 is responsible forgenerating the private and public key pairs as needed for embedding intothe client computing platforms. Fuse programming 222 is responsible forprogramming the fuses on the manufacturing floor with appropriate valuesin a robust and secure manner. These values would be used by the clientcomputing platform to build up the trust anchors and key ladders insidethe security processor.

The deployment component includes a certificate issuance component 204,a key generation (Key Gen) component 206, and a revocation manager 208.Certificate (Cert) issuance component 204 issues a digital certificatefor the SP Server and Client components giving them the authorization tointeract with such client systems for service deployment. Key generation(Key Gen) component 206 generates a cryptographic signing key pair, aroot key pair, digital certificates, and group public keys, and signsthe group public keys for each group. Revocation manager 208 determinesidentifiers and signatures of client computing systems to be added to arevocation list (RL), updates the RL, and distributes updated RLs.

The SP server 104 communicates over network 201 (such as the Internet)with the client computing system. The service provider server comprisesa SP server application 212 and a SP server agent 210. The SP serverapplication provides content browsing capabilities. The SP server agent210 controls the sending of client specific messages, managescryptographic keys and authorized user tokens, and maintains contentdelivery service status (for deployment purposes 212 and 210 could bephysically different servers firewalled and separated). Contentencrypter 214 accepts content 102 and encrypts the content for securedelivery to a client computing system. Content server 216 sends theencrypted content to the client. Key server 226 is responsible forprovisioning the title keys to the client computing systems within anauthenticated session. Server certificate 224 is used by the SP serveragent to participate in mutual authentication and establishment of theauthenticated session with the client computing systems. Communicationslinks between SP server agent 210, key server 226, and content server216 are protected by well accepted information security practices. Thekey server has the highest network and access protection to ensure onlyauthorized parties are able to reach it and the keys managed by the keyserver are isolated and firewalled from attackers from outside networkentities. The SP server agent or the key server has access to theprivate key associated with the server certificate 224. In anembodiment, this private key and all operations done with this privatekey are protected using a hardware security module (HSM) (not shown inFIG. 2) on the server.

In an embodiment, the cryptographic scheme used to authenticate theclient computing system with the SP server comprises a cryptographicauthentication protocol protecting a user's privacy based on the use ofzero-knowledge proofs. In an embodiment, the cryptographicauthentication protocol comprises the Enhanced Privacy ID (EPID) scheme,a Direct Anonymous Attestation (DAA) scheme with enhanced revocationcapabilities. EPID mitigates the privacy issues of common Rivest,Shamir, Adleman (RSA)—public key infrastructure (PKI) securityimplementations where every individual is uniquely identified for eachtransaction. Instead, EPID provides the capability of remote attestationbut only identifies the client computing system as having a component(such as a chipset) from a particular technology generation. EPID is agroup signature scheme, where one group's public key corresponds tomultiple private keys, and private keys generate a group signature whichis verified by the group public key. EPID provides the security propertyof being anonymous and unlinkable—given two signatures, one cannotdetermine whether the signatures are generated from one or two privatekeys. EPID also provides the security property of beingunforgeable—without a private key, one cannot create a valid signature.

Generally, setting up a secure communications channel with EPID may beaccomplished as follows. A first party (such as the client computingsystem) sends an EPID certificate to a second party (such as the serviceprovider server). Never knowing the identity of the first party and onlyknowing the first party is a computing platform with a trusted securityprocessor, the second party authenticates the first party. The firstparty then authenticates the second party using the second party'spublic key certificate. Since the second party doesn't require privacy,the second party's public key certificate may not be an EPID certificate(but it could be). The parties may then enter into a Diffie-Hellman (DH)key exchange agreement.

Various suitable embodiments of DAA and EPID are described in thefollowing co-patent applications, incorporated herein by reference: “AnApparatus and Method of Direct Anonymous Attestation from BilinearMaps,” by Ernest F. Brickell and Jingtao Li, Ser. No. 11/778,804, filedJul. 7, 2007; “An Apparatus and Method for a Direct AnonymousAttestation Scheme from Short-Group Signatures,” by Ernest F. Brickelland Jingtao Li, serial no. 12/208,989, filed Sep. 11, 2008; and “DirectAnonymous Attestation Scheme with Outsourcing Capability,” by Ernest F.Brickell and Jingtao Li, Ser. No. 12/286,303, filed Sep. 29, 2008. Inother embodiments, other authentication and attestation schemes may alsobe used.

The client computing system comprises at least three maincomponents—host software, chipset hardware/firmware, and theCPU/GFX/Media engines. It is assumed in embodiments of the presentinvention that the host software is untrusted. Even if the host softwaregets attacked, no secrets will be compromised. Host software isresponsible for network connection to SP server 104 and downloadingmedia from content server 216. Host software acts as a proxy betweenvarious SP servers and the chipset hardware/firmware. Host softwaresends encrypted content directly to the graphics hardware after thechipset hardware/firmware has completed title key unwrap and injectioninto the CPU/GFX component.

Chipset hardware/firmware is responsible for all protected processing,taking the role of the protected device for content protectionprocessing. In an embodiment, the chipset hardware/firmware sendsprotected title keys to the graphics hardware using the DMI mechanism.

The CPU/GFX component is responsible for final stream decryption, decodeand display. The GFX engine is a passive device, making no policydecisions. When asked, the GFX engine simply decrypts the content, thendecodes the submitted video slices. In an embodiment, the GFX engine(with protected media encoders) re-encrypts the display content for HDCPoutput protection over HDMI and wireless (e.g., WiDi) displays.

A protected client computing system must be remotely identified by aservice provider before sending highly sensitive information. Themechanism used to identify the platform must not violate user privacy.Embodiments of the present invention provide a protected mechanism for aservice provider to verify over the network that the service providerserver is communicating to a suitable client computing system andtransfer title keys and other confidential material to that clientcomputing system. In one embodiment, the protocol utilized to establisha protected session between the service provider server and the clientcomputing system is EPID. EPID allows for a single public key toanonymously verify the signature generated by N-private keys in what iscalled an EPID group. To implement EPID, each chipset contains a uniqueprivate key blown into the platform control hub (PCH) fuses duringsilicon manufacturing. In an embodiment, the chipset manufacturer places1,000,000 private keys in a single group and produces 400 groups foreach chipset produced. In order to act as the EPID verifier, eachservice provider will be provisioned with these 400 public keys.

Once a protected EPID session has been established, the service providerserver is free to exchange protected confidential information with theprotected client computing system. For content streaming, protectedtitle keys may be passed from an SP server to the security processor inthe chipset. The security processor sends the protected title keys tothe graphics and audio hardware. At this point, encrypted video andaudio content can be directly sent from a content server 216 to clientcomputing system graphics and audio hardware which decrypts, decodes,and displays the content. For downloading content, the securityprocessor binds the title keys to the client computing system using aunique platform storage key (again burned into PCH fuses duringmanufacturing) and returns the bound keys to media player software. Whenplayback is desired, the bound title keys are re-submitted to thesecurity processor, which unbinds and sends them in a protected mannerto the graphics and audio hardware.

FIG. 3 is a diagram of a client computing system 101 according to anembodiment of the present invention. A service provider (SP)player/media browser software application 302 may be included in thesoftware stack to interface with the SP server 104 over a network 201such as the Internet. The SP player/media browser 302 allows a user tobrowse content offerings of the service provider and to select contentto be delivered from the SP server to the client computing system. TheSP player/media browser provides user interface controls for the user tomanage a content library and to control the selection, downloading, andplayback of content. The SP player/media browser interacts with serviceagent 304. Service agent 304 comprises a software application providedby a service provider that is authorized to access the features of theclient computing system supporting end-to-end content protectionaccording to embodiments of the present invention. The service agentinterfaces with various SP player/media browser application programminginterfaces (APIs) (not shown in FIG. 2). Service agent 304 comprises amedia player component 306. The media player provides the content playerfunctionality (e.g., controlling playback).

SP client application 308 enables the SP player/media browser 302 andthe service agent 304 to access content protection features on theclient computing system's hardware and firmware and for relayingmessages to the service provider server 104. In an embodiment, the SPclient application comprises a host agent software development kit (SDK)including content protection APIs. In an embodiment, the SP clientapplication communicates with the security processor 314 in the platformcontrol hub (PCH) 312 of the chipset.

Audio driver 311 provides an interface between the media player andaudio decrypt hardware 316. Similarly, graphics (GFX) driver 310provides an interface between the media player and the GFX engine 320.In an embodiment, the PCH 312 comprises security processor 314, whichexecutes firmware to provide content protection functionality, alongwith other well known system functions. In an embodiment, the securityprocessor may be implemented by a Manageability Engine (ME). As contentis handled by the PCH 312 and the GFX engine 320, the content may beprotected at least in part by Protected Audio Video Path (PAVP)components 318, 322 in the PCH hardware/firmware and GFX enginehardware, respectively.

FIG. 4 is a flow diagram of secure content processing according to anembodiment of the present invention. At block 402, a user of the clientcomputing system uses SP player/media browser 302 to browse, discover,and purchase content from one or more service providers. At block 404,mutual authentication of the SP Server 104 and the client computingplatform 101 is performed. An authenticated session is established. Keyblobs with usage rights for a given set of content are provisioned. Thekey blobs are bound to the client computing system to ensure that thesystem is both confidentiality and integrity protected as necessary.

The client computing system then gets the encrypted content at block 406from content server 216 over network 201 (for streaming operations) orfrom local storage on the client computing system (for contentpreviously purchased, downloaded, and stored). The system is prepared towork on video slices (e.g., sub-frame). As a result, the hardware canprocess the data as soon as the first slice of data is submitted.

At block 408, the user initiates playback of the selected content usingthe SP player/media browser 302. The key blob is submitted to thesecurity processor 314 for unpacking and extracting of the title key.When that is done, the title key is loaded by the security processorinto the graphics hardware 320 for decryption. The SP player/mediabrowser submits the encrypted content to the media processing enginewithin GFX engine 320 at block 410. The GFX engine decrypts the contentusing the title keys and re-encrypts the content using a local protectedkey. Re-encrypted data may be stored in protected local or systemmemory. The re-encrypted content is subsequently obtained, decrypted,and decompressed at block 414. The decrypt is performed first. Once thedata is decrypted, the data is decoded/decompressed. Once the data isdecompressed, the data is re-encrypted and passed to the compositionengine via the system memory. Once the composition is finished, the datais again protected and passed using system memory to the display engine.In an embodiment, each component along the way has the ability todecrypt, process and re-encrypt as necessary.

At block 416, the GFX engine re-encrypts the media content using HDCPtechnology (in an embodiment) and delivers the content to the displayfor viewing by the user. At each step of the process, the content isnever in the clear where it is accessible by software or unauthorizedhardware components running on the client computing system.

FIG. 5 is a diagram of a secure content processing system according toan embodiment of the present invention. A SP server 104 interacts overnetwork 201 to client computing system 101. Client computing systemcomprises first 500 and second components 502. In an embodiment, thefirst component comprises a CPU and GFX component, and the secondcomponent comprises a platform control hub (PCH). In another embodiment,the first and second components may be combined into a single componentin a system-on-a-chip (SOC) implementation. First component 500 includesa plurality of processor cores 504, and GFX engine 320. Processor cores504 execute various components of host software (SW) 506 (as describedin FIG. 3), a client certificate 508, fuses 521, and a shared secret519. Host SW reads data, including encrypted content previously obtainedfrom a SP server or tangible media (such as a DVD, Blu-Ray, or otherstorage technology), from hard disk drive (HDD)/ solid state drive (SSD)510. In an embodiment, Host SW comprises at least a SP player/mediabrowser application 302, a service agent 304, and a SP clientapplication 308.

GFX engine 320 comprises a plurality of components. Mediaencrypt/decrypt engine 520 comprises logic to encrypt and decryptcontent. Media encode/decode engine 522 comprises logic to encode anddecode content. GFX Composition (Comp) engine 524 comprises logic toconstruct display images. Display engine 526 comprises logic to pass thecomposed display images to the display. Display encrypt/decrypt engine528 comprises logic to encrypt and decrypt display data prior to sendingthe display data to display 538 over protected link 527. Memoryencrypt/decrypt engine 530 comprises logic to encrypt and decrypt datastored in protected intermediate surfaces 534 in memory 536. Memory 536also includes logic to implement confidentiality and integrity protectedmemory operations 532.

Second component 502 comprises a plurality of components, some of whichare not shown in order to simplify FIG. 5. Second component comprises asecurity processor 314. Security processor includes firmware and/orhardware logic to provide attestation, provisioning key management, andoutput control operations 516 for the client computing system. Securityprocessor also includes fuses 517, shared secret 519, and trust anchors518 for supporting a PKI such as verification keys and key hierarchyinformation. Fuses 521, 517 are programmed into the hardware of thefirst and second components during manufacturing of the chipset with keymaterial for EPID use. The hardware root of trust is built up from theinformation programmed into the fuses on the manufacturing floor whenthe client computing system is manufactured. This ensures that eachindividual client computing system is unique, yet privacy protected.Shared secret 519 is hard-coded into the hardware of the first andsecond components during manufacturing of the chipset and CPU/GFXcomponents. In an embodiment, the shared secret may be used in settingup the secure chip to chip communications channel over the DMI link 538.

Client computing system also includes a protected real time clock 513for providing secure clock services, a display 538, and a non-volatilememory (NVM) 512. In an embodiment, the protected real-time clock may beseeded by a third party, and may be virtualized for multiple serviceproviders. The NVM may be used to store the firmware image for thesecond component, as well as to store temporary data (such as integrityand state information) for security processor processing operations.

In an embodiment, a processing flow may be described as follows. SPplayer/media browser 302 presents a user interface to the user. The usergoes to the service provider's web site to browse available content. TheSP web site has an auto detection capability to determine if the user'sclient computing system has integrated within it the capability ofauthenticating with the SP server 104. If capable, the user is allowedto choose content. The content may be bought, rented, or subscribed to,or may be streamed. The user pays for the content. SP player/mediabrowser 302 invokes security processor 316 to authenticate the clientcomputing system 101 with the SP server 104. In an embodiment, theauthentication uses EPID technology. The client computing system 101 isauthenticated at least in part by having the SP server 104 verify theclient computing system's certificate 508, perform a revocation check,and verify a certification path to a certificate authority (using theEPID protocol in one embodiment). When both the client computing system101 and the SP server 104 are authenticated, a secure communicationschannel may be set up based on the EPID protocol in one embodiment. Inan embodiment, once the secure communication channel is set up, acommand set may be used for end to end content protection capabilities.

The SP Server 104 provisions an encrypted title key to the clientcomputing system, with constraints on usage of the content (e.g., time).The SP server sends the encrypted title key over the secure channel tosecurity processor 314. Security processor 314 decrypts the encryptedtitle key, using its own key hierarchy. Security processor 314 uses astorage key to re-encrypt the newly decrypted title key to form a keyblob. The key blob is bound to the client computing system for aspecified time period. Security processor 314 sends the key blob to SPplayer/media browser 302 running in the CPU core. SP player/mediabrowser 302 stores the key blob in HDD/SSD 510. SP player/media browser302 then downloads the user-selected encrypted content. In oneembodiment, the downloaded encrypted content may be stored in theHDD/SSD 510.

When a user wants to play the content, the SP player/media browser 302submits the key blob back to the security processor 314. The securityprocessor verifies the signature of the key blob, and checks usageconstraints such as time, for example. The security processor 314 sendsthe encrypted title key over the encrypted channel (e.g., DMI link 538)to the media encrypt/decrypt component 520 of the GFX engine 320. Thesecurity processor instructs the SP player/media browser that theGFX/media engine is ready to process the encrypted content. The SPplayer/media browser 302 reads the encrypted content from the HDD/SDD510, or obtains the encrypted content from the SP server 104 over thenetwork 201 (for a streaming application), and sends the encryptedcontent to the GFX engine slice by slice.

The GFX engine 320 processes the encrypted content in a slice by slicemanner. For each slice, the SP player/media browser reads the sliceheaders in the clear. The rest of the slice is encrypted so that the SPplayer/media browser cannot access the content. The SP player/mediabrowser keeps track of playback state information using aninitialization vector. The media encrypt/decrypt engine 520 decrypts thecontent using the title key, after decrypting the encrypted title keyreceived from the security processor. In one embodiment, the output dataof the media encrypt/decrypt engine is still compressed according to thewell-known H.264 encoding scheme. In other embodiments, other encodingschemes may be used. The media encode/decode engine 522 decodes eachslice and then re-encrypts the slice using memory encrypt/decrypt 530.The re-encrypted content slice is stored in protected intermediatesurfaces 534 in memory 536. GFX composition engine 524 controls thecomposition of the image to be displayed on the display, including theforeground and background images, windows, etc. The GFX compositionengine obtains the re-encrypted content slices from protectedintermediate surfaces 534 in memory 536 to generate the composed image.The GFX composition engine 524 sends the composed image data to thedisplay engine 526.

The display engine uses display encrypt/decrypt engine 528 to decryptthe composed image from the encryption that was used to store thecontent slices in memory 536. The display engine 526 uses the displayencrypt/decrypt engine to re-encrypt the composed image data accordingto the HDCP technology, in one embodiment. The encrypted composed imagedata is sent by the GFX engine 320 over the protected chip to chip datainterface (e.g., DMI link) 538 to the second component 502, for transferto the display 538 over protected display interface link 527.

In an embodiment, there can be any number of concurrent, independentcontent streams being processed by the client computing system. Eachcontent stream has its own cryptographic context so as not to interferewith other streams. This also allows for the client computing system toensure that any kind of attack or compromise on one stream does notaffect the other content streams.

Embodiments of the present invention provide the capability forpurchasing goods and/or services related to, and/or obtaininginformation for, objects represented in digital content being renderedby the client computing system. FIG. 6 is a flow diagram of objectinformation processing according to an embodiment of the presentinvention. At block 602, SP player/media browser 302 displays digitalcontent for the user. As the user hears and sees the content, the usermay be interested in something in the content. In an embodiment, thedigital content comprises video, such as a movie or a TV program, forexample. For example, the user may see an image of at least one objectbeing displayed in at least one video frame of the sequence of videoframes for the content. Generally, the at least one object image may beany image representing a physical world object captured by a camera asat least a portion of the video frame. For example, the object image maybe an image in the video frame of a person, a plant or animal, avehicle, a household item, a building, a landscape feature, a consumergood, and so on. In another example, the object image may an icon,symbol, or other representative image added to the video frame torepresent an audio portion of the digital content, such as a song beingplayed. In another example, the object may not physically exist in thephysical world and may be a computer-generated, hand-drawn, or animatedimage added to the video frame. The user may also be interested inmultiple objects at a time while consuming the content. In oneillustrative example, the user may be watching a movie where an actor iswearing a coat and driving a car down a famous street in a particularcity, and the movie soundtrack at that time comprises a song. In thisexample, the user may be interested in getting information (includingpurchase information, where appropriate and available) about one or moreof the following objects: the actor, the coat, the car, the street, thecity, and the song.

In an embodiment, when the user is interested in getting informationabout an object of interest, or perhaps purchasing the object, the userselects the object image using a user input mechanism available to theclient computing system. In embodiments of the present invention, theavailable user input mechanism may comprise any user input device nowknown or to be developed, such as a computer mouse, keyboard, remotecontrol device, game controller, touch screen, detected user gesture,etc. In an embodiment, the user may pause the playback of the content inorder to provide the user input on a selected object image, and thenresume playback when the user input selection is made. In otherembodiments, pausing playback of the content may not be performed.

At block 604, the SP player/media browser accepts the input selectionfrom the user selecting the at least one object image being rendered inat least one video frame of a sequence of video frames on the display.In an embodiment, the user input data may comprise at least one of theelapsed time since the start of the display of the content and alocation in the video frame. For example, the user may select an objectimage being displayed at a particular (x, y) location in the video frameoccurring during playback at an elapsed time t. In an embodiment, thetime may be specified as hours, minutes, seconds, and milliseconds sincethe start of the displayed content. In another embodiment, the time maybe specified as a counter from the start of the display content (e.g., aframe count or other counter). In another embodiment, only the elapsedtime may be indicated by the user. In yet another embodiment, only thelocation may be indicated by the user.

As the user consumes the content and makes one or more selections ofobject images, the SP player/media browser in one embodiment stores theuser inputs at block 606. In one embodiment, the SP player/media browsersecurely communicates and stores the user inputs in a secure storagelocation in NVM 512 using security processor 314 and DMI link 538. Thishelps to provide privacy for the user about content consumed andassociated information requests and purchase transactions. In anembodiment, each individual user input may be stored as a separateoperation. In another embodiment, user inputs from consumption of aparticular digital content title (or portion thereof) may be stored in asingle storage operation at the end of content consumption processing.Processing of blocks 602, 604, and 606 may occur even when the clientcomputing system 101 is not connected to network 201.

In an embodiment, once the content is consumed and the client computingsystem is connected to the network, the SP player/media browser usesservice agent 304, SP client application 308, and security processor 314to obtain the stored user inputs from NVM 512 and to securely transmitthe user inputs to SP server application 212 on SP server 104 usingmethods discussed above. In another embodiment, if the client computingsystem is connected to the network while the content is being consumed,and if the user has selected he or she wants immediate feedback oninformation requests, the SP player/media browser may send eachindividual user input in real time to the SP server application on theservice provider server for processing. Regardless of whether the userinputs are batched or handled individually, in one embodiment, the SPserver application compares each user input to entries in a contentobject information database at block 610. In an embodiment, thecomparison may involve attempting to match the time and locationinformation from the user inputs to known information about the audioand video portions of the content.

FIG. 7 is a diagram of object information processing components on aservice provider server according to an embodiment of the presentinvention. SP server application 212 securely receives one or more userinputs 702 from the client computing system over the network. The SPserver application has access to content 102. In one embodiment, one ormore components of the SP server, such as SP server application, forexample, may be used to generate a content object information database704 based on static analysis of the content. That is, the content may beanalyzed for object images before distributing the content to any clientcomputing system. The content object information database includes anentry for each object image in the content that is supported by theservice provider for providing information to the user based on aninformation request. In an embodiment, a content object informationdatabase may be built by the service provider for each supported contenttitle.

In an embodiment, prior to distribution of the content and/or supportingobject information requests, service provider personnel analyze theaudio and video portions of the content, identify object images, andcreate database entries for supported identified objects. In anembodiment, identified objects to be supported may be selected based oncurrent advertising and/or marketing campaigns of the content provider,service provider, and/or another entity. In one embodiment, relevantinformation associated with supported objects may be obtained and storedin the content object information database. In another embodiment, linksto the relevant information may be stored, and the information may beobtained as needed from any information source (e.g., the Internet,other data structures, other databases, etc.). In yet anotherembodiment, the service provider may dynamically change the informationin the content object information database at any time for any selectedsupported object due to such things as changing market conditions,advertising campaign changes, current events such as weather, sportsscores, news items, etc., time of day, time of year, and so on.

Information obtained from the content object information database 704 orobtained from other sources that is associated with the selected objectmay be identified as object information 710. For example, when theobject is a consumer good, the object information may comprise one ormore of the brand name, manufacturer, model number, title, price,availability, features, and so on. For example, when the object is aperson, such as an actor or actress, the object information may includeone or more of the person's biographical information, film resume, fanclub information, link to a website, and so on. For example, when theobject is a city or landmark, the object information may includeinformation about visiting the city or landmark. For example, when theobject image is representing a song, the object information may includeone or more of song title, artist, album title, record company, andpurchase information. Generally, object information comprises anyinformation related to the object. In one embodiment, object informationincludes information about purchasing the object or a related goodand/or service.

In an embodiment, the SP server application may securely maintain a userprofile 706 for the user on the service provider server. The userprofile comprises at least one of preferences and interests of the user.In an embodiment, the SP server application may select and/or tailorobject information based at least in part on the user profile. In oneembodiment, the user may enter or select his or her preferences and/orinterests by affirmative action by the user using the SP player/mediabrowser. In another embodiment, the SP server application may developand maintain the user profile based at least in part on the contentdelivered to the user's client computing system and/or the user inputsreceived by the service provider server over time. In an embodiment, thepreferences may include what types of information the user is interestedin, and how, when and in what format the user wants to receive theinformation. In an embodiment, preferences may include purchaseparameters, such as financial limits for purchases, purchasenotifications and approvals, etc. Other preferences may also bespecified. In an embodiment, interests may include things the userselects as interests (e.g., sports, hobbies, television, film, and musicgenres, etc.) as well as interests determined by analyzing pastbehavior, such as received user inputs and delivered and/or consumedcontent. In an embodiment, the user inputs may be stored as part of theuser profile.

Returning back to FIG. 6, at block 612, when a match occurs whencomparing the user input for a selected object (represented by an objectimage) and an entry in the content object information database, in oneembodiment the SP server application obtains and stores informationabout the object corresponding to the selected object image into theuser profile. In another embodiment, links to the relevant informationmay be stored in the user profile, and the information may be obtainedas needed from any information source (e.g., the Internet, other datastructures, other databases, etc.). At block 614, upon request, the SPserver application on the service provider server sends the objectinformation from the user profile (or obtains the object informationfrom another source as needed) to the SP player/media on the clientcomputing system. In one embodiment, this may occur when the user logsin to a web site operated by the service provider and requests one ormore of the object information. At block 616, the SP player/mediabrowser displays the requested object information to the user. In anembodiment, the object information may include purchase informationallowing the user to complete a purchase transaction for the object. Inan embodiment, blocks 608, 610, 612, and 614 may be performed in realtime, without waiting for the user to log in to a website to request theobject information. In an embodiment, the user may pause playback of thecontent to view the requested object information.

Referring back to FIG. 7, in one embodiment, dynamic analysis 708 may beperformed by the SP server application on the content, instead of staticanalysis, resulting in stored content object information databaseentries. Dynamic analysis component 708 may analyze audio portions andvideo frames of content 102 based at least in part on received userinput 702. The dynamic analysis component may use known audiorecognition, image recognition, and/or facial recognition processingtechniques to analyze one or more of the audio portions and video framesindicated by the user input to attempt to determine one or more selectedobject images or sounds in the content copy on the service providerserver, as the content is being consumed on the client computing system.For example, if the content is being streamed to the client computingsystem, as the content is streamed over the network, the content on theserver may be analyzed to determine objects in current content portions.The SP server application accepts the user inputs and associates them tothe currently streamed content portions. When an object is identified bysuch dynamic analysis, then the SP server application obtains objectinformation 710 that relates to the identified object, and continueswith blocks 612, 614, and 616.

Embodiments of the present invention capture user interest in objects ina way that is more extensible and flexible than adding pre-determinedhotspots into the video frames. In embodiments of the present invention,the service provider server may dynamically determine if there isanything interesting to the user in the content portions and take actionindependently, or take different actions for the same user input atdifferent times.

Reference in the specification to “one embodiment” or “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiment may be included in at least animplementation. The appearances of the phrase “in one embodiment” invarious places in the specification may or may not be all referring tothe same embodiment.

Also, in the description and claims, the terms “coupled” and“connected,” along with their derivatives, may be used. In someembodiments of the invention, “connected” may be used to indicate thattwo or more elements are in direct physical or electrical contact witheach other. “Coupled” may mean that two or more elements are in directphysical or electrical contact. However, “coupled” may also mean thattwo or more elements may not be in direct contact with each other, butmay still cooperate or interact with each other.

Thus, although embodiments of the invention have been described inlanguage specific to structural features and/or methodological acts, itis to be understood that claimed subject matter may not be limited tothe specific features or acts described. Rather, the specific featuresand acts are disclosed as sample forms of implementing the claimedsubject matter.

1. A method of processing digital content on a client computing systemcomprising: rendering digital content by the client computing system;accepting user input data from a user selecting at least one objectimage in at least one video frame of a sequence of video frames of thedigital content being rendered; sending the user input data to a servercoupled to the client computing system over a network via a securecommunications channel; receiving information about an objectcorresponding to the selected object image from the server; anddisplaying the object information on the client computing system.
 2. Themethod of claim 1, wherein the selected at least one object imagecomprises an image of an object captured by a camera as at least aportion of at least one of the video frames.
 3. The method of claim 1,wherein the user input data comprises at least one of a location of theselected at least one object image in the at least one video frame shownon a display of the client computing system and an elapsed time from thestart of rendering of the video frames.
 4. The method of claim 2,wherein the captured object comprises a physical world object.
 5. Themethod of claim 4, wherein the captured object comprises a consumergood.
 6. The method of claim 1, wherein the object information comprisesinformation to enable the user to purchase the object.
 7. A clientcomputing system for processing digital content comprising: a user inputmechanism for entering user input data; a display; and a processoradapted to render digital content, to accept user input data from a uservia the user input mechanism to select at least one object image in atleast one video frame of a sequence of video frames of the digitalcontent being rendered, to send the user input data to a server coupledto the client computing system over a network via a securecommunications channel, to receive information about an objectcorresponding to the selected object image from the server, and to causethe display of the object information on the display.
 8. The clientcomputing system of claim 7, wherein the selected at least one objectimage comprises an image of an object captured by a camera as at least aportion of at least one of the video frames.
 9. The client computingsystem of claim 7, wherein the user input data comprises at least one ofa location of the selected at least one object image in the at least onevideo frame shown on the display of the client computing system and anelapsed time from the start of rendering of the video frames.
 10. Theclient computing system of claim 8, wherein the captured objectcomprises a physical world object.
 11. The client computing system ofclaim 10, wherein the captured object comprises a consumer good.
 12. Theclient computing system of claim 7, wherein the object informationcomprises information to enable the user to purchase the object.
 13. Acomputer-readable medium comprising one or more instructions that whenexecuted on a processor of a client computing system configure theprocessor to process digital content by rendering digital content;accepting user input data from a user selecting at least one objectimage in at least one video frame of a sequence of video frames of thedigital content being rendered; sending the user input data to a servercoupled to the client computing system over a network via a securecommunications channel; receiving information about an objectcorresponding to the selected object image from the server; and causingthe display of the object information on a display of the clientcomputing system.
 14. The computer-readable medium of claim 13, whereinthe selected at least one object image comprises an image of an objectcaptured by a camera as at least a portion of at least one of the videoframes.
 15. The computer-readable medium of claim 13, wherein the userinput data comprises at least one of a location of the selected at leastone object image in the at least one video frame shown on a display ofthe client computing system and an elapsed time from the start ofrendering of the video frames.
 16. The computer-readable medium of claim14, wherein the captured object comprises a physical world object. 17.The computer-readable medium of claim 16, wherein the captured objectcomprises a consumer good.
 18. The computer-readable medium of claim 14,wherein the object information comprises information to enable the userto purchase the object.
 19. A method of processing digital contentcomprising: rendering digital content by a first application on a clientcomputing system; accepting, by the first application, user input datafrom a user selecting at least one object image in at least one videoframe of a sequence of video frames in the digital content beingrendered; storing the user input data in a secure storage within theclient computing system; sending the user input data to a secondapplication on a server coupled to the client computing system over anetwork via a secure communications channel; comparing, by the secondapplication, the user input data to entries in a content objectinformation database on the server; when the user input data matches anentry in the content object information database, obtaining and storing,by the second application, information about an object corresponding tothe selected object image; sending the object information, by the secondapplication, to the first application over the secure communicationschannel; and displaying, by the first application, the objectinformation on the client computing system.
 20. The method of claim 19,wherein the selected at least one object image comprises an image of anobject captured by a camera as at least a portion of at least one of thevideo frames.
 21. The method of claim 19, wherein the user input datacomprises at least one of a location of the selected at least one objectimage in the at least one video frame shown on a display of the clientcomputing system and an elapsed time from the start of rendering of thevideo frames.
 22. The method of claim 20, wherein the captured objectcomprises a physical world object.
 23. The method of claim 22, whereinthe captured object comprises a consumer good.
 24. The method of claim22, wherein the captured object comprises a person.
 25. The method ofclaim 19, wherein the selected object image represents a song.
 26. Themethod of claim 19, wherein the object information comprises informationto enable the user to purchase the object.
 27. The method of claim 19,wherein the content information database comprises an entry for eachobject image in the content that is supported for providing objectinformation to the user.
 28. The method of claim 27, further comprisinganalyzing audio and video portions of the content, identifying objectimages, and creating entries in the content information database foridentified object images prior to distribution of the content.
 29. Themethod of claim 27, further comprising analyzing audio and videoportions of the content based at least in part on the user input data,identifying object images, and creating entries in the contentinformation database for identified object images as the content isbeing consumed on the client computing system.
 30. The method of claim27, further comprising dynamically changing the object information inthe content information database.
 31. The method of claim 19, whereinstoring, by the second application, information about an objectcorresponding to the selected object image comprises storing the objectinformation in a user profile on the server, and tailoring objectinformation to send to the client computing device based at least inpart on the user profile.
 32. The method of claim 31, further comprisingdetermining interests of the user based at least in part on contentdelivered to the client computing system and user inputs, and storinginterests of the user in the user profile.
 33. A system comprising: aclient computing system to render digital content, to accept user inputdata from a user selecting at least one object image in at least onevideo frame of a sequence of video frames in the digital content beingrendered, and to store the user input data in a secure storage withinthe client computing system; and a server, coupled to the clientcomputing system over a network via a secure communications channel, toreceive the user input data from the client computing system, to comparethe user input data to entries in a content object information databaseon the server, when the user input data matches an entry in the contentobject information database, to obtain and store information about anobject corresponding to the selected object image, and to send theobject information to the client computing system over the securecommunications channel; wherein the client computing system is todisplay the object information to the user.
 34. The system of claim 33,wherein the selected at least one object image comprises an image of anobject captured by a camera as at least a portion of at least one of thevideo frames, and the user input data comprises at least one of alocation of the selected at least one object image in the at least onevideo frame shown on a display of the client computing system and anelapsed time from the start of rendering of the video frames.
 35. Thesystem of claim 34, wherein the captured object comprises a physicalworld object.
 36. The system of claim 33, wherein the object informationcomprises information to enable the user to purchase the object.